MAL-2026-11196

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wbnr/design/MAL-2026-11196.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11196
Published
2026-07-30T13:45:50Z
Modified
2026-08-06T23:50:03Z
Summary
Malicious code in @wbnr/design (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd)

The package's preinstall lifecycle script runs automatically on npm install. It reads the installer's username (from USER/USERNAME environment variables) and the machine hostname (via os.hostname()), then embeds those identifiers along with the package name and a timestamp into both a DNS lookup and an HTTPS GET request directed at a hardcoded Burp Collaborator subdomain, 4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com. The package name and scope (@wbnr) and its self-description indicate a dependency-confusion payload targeting an internal organization scope; any environment that resolves @wbnr/design from public npm will leak installer host identifiers to the attacker-controlled out-of-band endpoint. The 'harmless bug bounty PoC' framing in the package description does not change the observable behavior: installer-owned identifiers leave the machine to a third-party OOB collector on install.

Source: ossf-package-analysis (dbd908eecacbb587e9534c244be33296e6fa11092200cba8428351bb66afe844)

The OpenSSF Package Analysis project identified '@wbnr/design' @ 99.3.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-30T14:19:34.316178276Z",
            "modified_time": "2026-07-30T13:45:50Z",
            "sha256": "dbd908eecacbb587e9534c244be33296e6fa11092200cba8428351bb66afe844",
            "source": "ossf-package-analysis",
            "versions": [
                "99.3.0"
            ]
        },
        {
            "id": "IN-MAL-2026-011131",
            "import_time": "2026-08-04T22:30:00.784588988Z",
            "modified_time": "2026-08-04T21:36:58Z",
            "sha256": "1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd",
            "source": "amazon-inspector",
            "versions": [
                "99.3.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016682",
            "import_time": "2026-08-06T18:09:05.600020592Z",
            "modified_time": "2026-08-06T16:22:30Z",
            "sha256": "0d07baf819b813827e862b75445e87817d518ede3d6c8b50e31318f7cbf1c8bb",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016673",
            "import_time": "2026-08-06T18:09:04.235829925Z",
            "modified_time": "2026-08-06T16:18:59Z",
            "sha256": "767eeda3c5b3b685e6ea9e5695dff1ab71916777db0f00e6aa07c23066dfb45b",
            "source": "amazon-inspector",
            "versions": [
                "99.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016676",
            "import_time": "2026-08-06T18:09:04.641898972Z",
            "modified_time": "2026-08-06T16:19:58Z",
            "sha256": "d4cb3f7aa3de4f3fd484b778d61d19ef4d8d9ff1676c356930754ed9353db9de",
            "source": "amazon-inspector",
            "versions": [
                "99.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @wbnr/design

Package

Name
@wbnr/design
View open source insights on deps.dev
Purl
pkg:npm/%40wbnr/design

Affected ranges

Affected versions

99.*
99.0.0
99.0.1
99.1.0
99.3.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "sha256": "5ca85b25f366c6f2a2fe17799593c39150e2d5e581c9827e37f033646e9f8b24",
            "tlsh": "acf0ace8b395eb310ce012c4b16c191f95a7e35271de68824855a3d247b2a718711aa8"
        },
        {
            "path": "package.json",
            "sha256": "617f3bb9665f5f662855057885a56a79c2cf590f4ddfed6c662242f8d81ec53d",
            "tlsh": "a5e0f178cc00a83328d156d724364251e8958d6784097d0c33d3010d834f6735bff20f"
        }
    ],
    "package_integrity": [
        {
            "filename": "design-99.3.0.tgz",
            "hashes": {
                "sha1": "bb8fc9200d4177958cc09626faf51de64251aae7",
                "sha512_sri": "sha512-2yZeeCMPEK2mEa0OetglJnF4lDOvQHRXIvV30HrJxrXxi6D1gF11PEeHiS9b2zmwmD5xLfV3zrsEso7oeIcNDQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wbnr/design/MAL-2026-11196.json"